Not sure where this should go, so why not in SE. Here is an academic paper on the topic by researches from Carnegie Mellon University that was just released on the Proceedings of the National Academy of Sciences web site and a couple links to articles reporting on it.

I always wondered about this since I knew that the first 5 were easy to guess, just didn't know how easy the last 4 are.

"The Social Security number's first three digits -- called the "area number" -- is issued according to the Zip code of the mailing address provided in the application form. The fourth and fifth digits -- known as the "group number" -- transition slowly, and often remain constant over several years for a given region. The last four digits are assigned sequentially"

I have two brothers (two years apart, so this spans four years) and we all have the same first five numbers.

I was in the service some years ago and I remember personnel specialists being able to tell you your place of birth based on your SSN. It was a big joke. Some of them claimed to by psychic. You'd put your home of record as being say Utah and they'd say, "but you were born around San Francisco, right?" Everybody would chuckle and life would go on.

My wife does medical work and turned me on to the Social Security Death Index. This is a database where you can find out if a particular social belongs to a dead person. I started thinking years ago that with that data (to help bracket in the last four numbers based on birthdate) and the first five that were already easily guessable that you'd be on a legit number in no time. Bad news is that the SSDI is freely available via many genealogy sites.